.gitlab-ci.yml

# SPDX-License-Identifier: MIT
# Copyright (C) 2022-2023 iris-GmbH infrared & intelligent sensors


# TODO: implement needs:parallel:matrix once feature is stable: https://docs.gitlab.com/ee/ci/yaml/index.html#needsparallelmatrix
# TODO: use GitLab CI variables for defining parallism, once supported: https://gitlab.com/gitlab-org/gitlab/-/issues/11549

#####################
### INCLUDE FILES ###
#####################

include:
  - ".gitlab/common-template.yml"
  - ".gitlab/release-template.yml"
  - ".gitlab/develop-template.yml"

###############################
### CI VARIABLE DEFINITIONS ###
###############################

variables:
  BUILD_IMAGE_TAG: "latest"
  RELEASE_BRANCH: "master"
  BUILD_IMAGE_IRIS_KAS: "${CI_REGISTRY_IMAGE}:${BUILD_IMAGE_TAG}"
  RENOVATE_PLATFORM: "gitlab"
  RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
  RENOVATE_REPOSITORIES: "[ \"${CI_PROJECT_PATH}\" ]"
  RENOVATE_REVIEWERS: "[ \"jasper.orschulko\", \"rico.biedermann\", \"thomas.noack\", \"parian.golchin\", \"an.tran\", \"michael.kirscht\", \"jan.hannig\", \"erik.schumacher\", \"paul.gieseler\" ]"
  RENOVATE_PR_CONCURRENT_LIMIT: "0"
  RENOVATE_PR_HOURLY_LIMIT: "0"
  # Set extra flags for the renovate bot
  RENOVATE_EXTRA_FLAGS: ""
  FORCE_RENOVATE_RUN: "false"
  RENOVATE_DRY_RUN: "false"
  KAS_RUNNER_TAG: "kas-large"
  USE_IDENTICAL_NAMED_BRANCHES:
    value: "true"
    description: 'Set to "true" to use identical named branches in iris meta layers during build'
  REPRODUCIBLE_BUILD:
    value: "false"
    description: 'Set to "true" to archive build artifacts required for making the firmware build reproducible. WARNING: We can only guarantee reproducibility for changes done to protected branches!'
  SKIP_OCI_TESTS:
    value: "false"
    description: 'Set to "true" to skip the OCI tests.'
  SKIP_PTEST_TESTS:
    value: "true"
    description: 'Set to "false" to run the PTEST tests.'
  SKIP_MAINTENANCE_IMAGE_BUILD:
    value: "false"
    description: 'Set to "true" to skip the maintenance image build'
  SKIP_DEPLOY_IMAGE_BUILD:
    value: "true"
    description: 'Set to "false" to build the deploy image'
  SKIP_DEV_IMAGE_BUILD:
    value: "true"
    description: 'Set to "false" to build the dev image'
  SKIP_SDK_IMAGE_BUILD:
    value: "true"
    description: 'Set to "false" to build the Yocto SDK'
  FORCE_IRIS_KAS_CONTAINER_BUILD:
    value: "false"
    description: 'Set to "true" to force (re-)build the iris-kas build container on the current branch.'
  SKIP_SYSTEMTEST_SMOKE:
    value: "true"
    description: 'Set to "false" to add execution of systemtest_smoke job. Skipping system smoke test will also skip any additional Systemtests.'
  SKIP_SYSTEMTEST_RELIABILITY:
    value: "true"
    description: 'Set to "false" to add execution of systemtest_reliability job.'
  BUILD_FROM_SCRATCH:
    value: "false"
    description: 'Set to "true" to build from scratch.'
  BUILD_TARGETS:
    value: ""
    description: 'Specify one or more products you want to build as a space separated string. Currently supported products: irma6r2, irma6r1, matrix. If left empty, all available products will be built.'


################
### WORKFLOW ###
################

workflow:
  rules:
    # Do not run merge pipeline on draft MRs
    - if: '$CI_MERGE_REQUEST_TITLE =~ /^Draft:/'
      when: never
    # Allow scheduled builds
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    # Allow manually triggering a build from the webinterface
    - if: '$CI_PIPELINE_SOURCE == "web"'
    # Allow triggering from upstream pipeline
    - if: '$CI_PIPELINE_SOURCE == "pipeline"'
    # Automatic build on merge request/changes to merge request
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    # Trigger an automatic build if a new, valid tag is pushed.
    # examples for valid tags:
    # irma6r1-1.0-1, irma6r2-1.0-1-RC1, irma6r2-1.0-1-support_release
    - if: '$CI_COMMIT_TAG && $CI_COMMIT_TAG =~ /^(?<product_identifier>irma6r[1-2])-(?<major>\d+)\.(?<minor>\d+)-(?<feature_version>\d+)(-(?<support_release_suffix>\w+))?$/'
    # allow building the latest iris-kas container image if required
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
      changes:
        - Dockerfile_iris_kas
    # automatically start pipeline for CI branches (-ci / _ci suffix)
    - if: '$CI_COMMIT_BRANCH =~ /^.*(_|-)ci$/'


########################
### DEFAULT SETTINGS ###
########################

default:
  tags:
    # run on gitlab runners designed for kas builds
    - kas
  image:
    name: "${BUILD_IMAGE_IRIS_KAS}"
    pull_policy:
      - always
  retry:
    max: 2
    when:
      - unknown_failure
      - api_failure
      - stuck_or_timeout_failure
      - runner_system_failure
      - job_execution_timeout
      - scheduler_failure
      - data_integrity_failure

  before_script:
    # configure git safe directory
    - if command -v git >/dev/null 2>&1; then git config --global --add safe.directory "${CI_PROJECT_DIR}"; fi
    # if called from upstream pipeline, attempt to checkout identical named branch in iris-kas
    - |
      if [ -n "${UPSTREAM_PROJECT_NAME}" ] && [ "${RELEASE}" != "true" ] && command -v git >/dev/null 2>&1; then
        echo "Trying to checkout ${BRANCH_NAME} in iris-kas"
        if git checkout ${BRANCH_NAME} 2>/dev/null; then
          echo "Branch ${BRANCH_NAME} has been checked out in iris-kas"
        else
          echo "Branch ${BRANCH_NAME} not found in iris-kas. Sticking with develop branch on iris-kas"
        fi
      fi


##############
### STAGES ###
##############

stages:
  - setup
  - build-container
  - generate-pipeline
  - trigger-generated-pipeline


###################
### SETUP STAGE ###
###################

renovate:
  stage: setup
  rules:
    - !reference [.develop_template, rules]
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - if: $FORCE_RENOVATE_RUN == "true"
  image: renovate/renovate:39.20.3-full
  tags:
    - gp
  script:
    - renovate ${RENOVATE_EXTRA_FLAGS}
  allow_failure: true

# We do not want to run a pipeline on merges to non-default branch.
# During a release process (merge target branch master), we are interested in the release candidate builds, not the merge request
# builds, as the development and release pipelines work fundamentally different.
# However, since a merge request is blocked regardless of branch, as long as no pipeline is run, we need a empty placeholder
# job for the pipeline to "turn green".
skip-non-default-branch-merge-pipeline:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $RELEASE_BRANCH'
  stage: setup
  variables:
    GIT_STRATEGY: none
  tags:
    - gp-tiny
  script:
    - echo "Running empty pipeline on merge request targeting release branch ${RELEASE_BRANCH}"

build-container-get-tag:
  rules:
    - !reference [.common_template, rules, build_container_rules]
  stage: setup
  tags:
    - gp-tiny
  image: busybox:1.37.0-uclibc
  script:
    # Default branch = latest tag
    # Release = release tag
    # All other branches are tagged with the currently built commit SHA hash
    - |
      if [[ "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" ]]; then
        BUILD_IMAGE_TAG="latest"
      elif [[ -n "$CI_COMMIT_TAG" ]]; then
        BUILD_IMAGE_TAG="$CI_COMMIT_TAG"
      else
        BUILD_IMAGE_TAG="git-${CI_COMMIT_SHORT_SHA}"
      fi
    - echo "BUILD_IMAGE_TAG set to ${BUILD_IMAGE_TAG}."
    - echo "BUILD_IMAGE_TAG=${BUILD_IMAGE_TAG}" >> build.env
  artifacts:
    reports:
      dotenv: build.env


###################################
### BUILD BUILD CONTAINER STAGE ###
###################################

build-iris-kas-container:
  stage: build-container
  needs:
    - job: build-container-get-tag
  rules:
    - !reference [.common_template, rules, build_container_rules]
  parallel:
    matrix:
      - TAG: gp
        ARCH: amd64
      - TAG: gp-arm
        ARCH: arm64
  tags:
    - ${TAG}
  image: gcr.io/kaniko-project/executor:v1.23.2-debug
  script:
    - >-
      /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${CI_PROJECT_DIR}/Dockerfile_iris_kas"
      --destination "${BUILD_IMAGE_IRIS_KAS}-${ARCH}"
      --tar-path "iris-kas-container-${ARCH}.tar"
  artifacts:
    name: "iris-kas-container-${ARCH}"
    paths:
      - "iris-kas-container-*"
    expire_in: "7 days"

merge-container-manifests:
  stage: build-container
  needs:
    - job: build-container-get-tag
    - job: build-iris-kas-container
  tags:
    - gp-tiny
  rules:
    - !reference [.common_template, rules, build_container_rules]
  variables:
    GIT_STRATEGY: none
  image: mplatform/manifest-tool:alpine-v2.0.6
  script:
    - >-
      manifest-tool
      --username=${CI_REGISTRY_USER}
      --password=${CI_REGISTRY_PASSWORD}
      push from-args
      --platforms linux/amd64,linux/arm64
      --template ${BUILD_IMAGE_IRIS_KAS}-ARCH
      --target ${BUILD_IMAGE_IRIS_KAS}

###############################
### GENERATE PIPELINE STAGE ###
###############################

.generate-pipeline:
  stage: generate-pipeline
  tags:
    - gp-tiny
  image: mikefarah/yq:4.44.5
  artifacts:
    paths:
      - .gitlab/build-ci-template.yml

release-generate-pipeline:
  extends: .generate-pipeline
  rules:
    - !reference [.release_template, rules]
  script:
    - >
      if [[ "${CI_COMMIT_TAG}" =~ ^irma6r1-.* ]]; then
          yq -i '.".target_multi_confs".MULTI_CONF = ["sc573-gen6"]' .gitlab/build-ci-template.yml
          yq -i '.".oci_multi_confs".MULTI_CONF = ["qemux86-64-r1"]' .gitlab/build-ci-template.yml
          yq -i '.".all_multi_confs".MULTI_CONF = ["sc573-gen6", "qemux86-64-r1"]' .gitlab/build-ci-template.yml
      elif [[ "${CI_COMMIT_TAG}" =~ ^irma6r2-.* ]]; then
          yq -i '.".target_multi_confs".MULTI_CONF = ["imx8mp-irma6r2"]' .gitlab/build-ci-template.yml
          yq -i '.".oci_multi_confs".MULTI_CONF = ["qemux86-64-r2"]' .gitlab/build-ci-template.yml
          yq -i '.".all_multi_confs".MULTI_CONF = ["imx8mp-irma6r2", "qemux86-64-r2"]' .gitlab/build-ci-template.yml
      else
        echo "No valid multi-conf tag prefix was given"
        exit 1
      fi
    - echo "Generated child pipeline:"
    - cat .gitlab/build-ci-template.yml

develop-generate-pipeline:
  extends: .generate-pipeline
  rules:
    - !reference [.develop_template, rules]
    - when: on_success
  script:
    # if BUILD_TARGETS is defined then don't use default multi_confs
    - >
      if test -n "${BUILD_TARGETS}"; then
          yq -i '.".target_multi_confs".MULTI_CONF = []' .gitlab/build-ci-template.yml
          yq -i '.".oci_multi_confs".MULTI_CONF = []' .gitlab/build-ci-template.yml
          yq -i '.".all_multi_confs".MULTI_CONF = []' .gitlab/build-ci-template.yml
      fi
    - >
      case "${BUILD_TARGETS}" in
        *irma6r1*)
          yq -i '.".target_multi_confs".MULTI_CONF += ["sc573-gen6"]' .gitlab/build-ci-template.yml;
          yq -i '.".oci_multi_confs".MULTI_CONF += ["qemux86-64-r1"]' .gitlab/build-ci-template.yml;
          yq -i '.".all_multi_confs".MULTI_CONF += ["sc573-gen6", "qemux86-64-r1"]' .gitlab/build-ci-template.yml;
      esac
    - >
      case "${BUILD_TARGETS}" in
        *irma6r2*)
          yq -i '.".target_multi_confs".MULTI_CONF += ["imx8mp-irma6r2"]' .gitlab/build-ci-template.yml;
          yq -i '.".oci_multi_confs".MULTI_CONF += ["qemux86-64-r2"]' .gitlab/build-ci-template.yml;
          yq -i '.".all_multi_confs".MULTI_CONF += ["imx8mp-irma6r2", "qemux86-64-r2"]' .gitlab/build-ci-template.yml;
      esac
    - >
      case "${BUILD_TARGETS}" in
        *matrix*)
          yq -i '.".target_multi_confs".MULTI_CONF += ["imx93-evk"]' .gitlab/build-ci-template.yml;
          yq -i '.".target_multi_confs".MULTI_CONF += ["imx93-matrixup"]' .gitlab/build-ci-template.yml;
          yq -i '.".oci_multi_confs".MULTI_CONF += ["qemux86-64-matrix"]' .gitlab/build-ci-template.yml;
          yq -i '.".all_multi_confs".MULTI_CONF += ["imx93-evk", "imx93-matrixup", "qemux86-64-matrix"]' .gitlab/build-ci-template.yml;
      esac
    - echo "Generated child pipeline:"
    - cat .gitlab/build-ci-template.yml


########################################
### TRIGGER GENERATED PIPELINE STAGE ###
########################################

.trigger-generated-pipeline:
  stage: trigger-generated-pipeline
  trigger:
    include:
      - artifact: .gitlab/build-ci-template.yml
        job: release-generate-pipeline
      - artifact: .gitlab/build-ci-template.yml
        job: develop-generate-pipeline
    strategy: depend

release-trigger-generated-pipeline:
  extends: .trigger-generated-pipeline
  rules:
    - !reference [.release_template, rules]
  trigger:
    include:
      - artifact: .gitlab/build-ci-template.yml
        job: release-generate-pipeline
    strategy: depend

develop-trigger-generated-pipeline:
  extends: .trigger-generated-pipeline
  rules:
    - !reference [.develop_template, rules]
    - when: on_success
  trigger:
    include:
      - artifact: .gitlab/build-ci-template.yml
        job: develop-generate-pipeline
    strategy: depend
    forward:
      pipeline_variables: true